This section introduces aspects that may help facilitate a better understanding of the inventions. Accordingly, the statements of this section are to be read in this light and are not to be understood as admissions about what is prior art or what is not prior art.
Various facilities available via communication networks, such as the World Wide Web, permit users to create their own applications or web pages. One example is known as a “mashup,” which is a web page or application that uses or combines data or functionality from two or many more sources to create a new service or application.
A problem arises, however, when the user is required to give his/her credentials (username and password) for one source to another source, thus exposing information between sources and giving one source full access to the other source. This may not be desirable to the user.
A protocol known as OAuth attempts to provide a solution to this problem. In general, the OAuth protocol (see http://oauth.net/) enables users to provide third-party access to their web resources without sharing their passwords. However, there are several limitations and weaknesses to this protocol. First, since the protocol is tied to the Hypertext Transfer Protocol (HTTP), it is not applicable to non-web applications. Second, since the protocol relies on the use of HTTP redirection, it is vulnerable to phishing attacks. The protocol also requires multiple round trips for obtaining delegated authorization, and it is not optimal for application performance. Lastly, since the protocol uses more than one type of delegation proof and a proofing scheme that involves repeated cryptographic signing, it is more complex than necessary.
As such, there is a need for an improved approach to authority delegation that overcomes these and other drawbacks.